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1.0 


SUMMARY 


There were two investigative aspects associated with the loss of 
the cryogenic oxygen tank pressure during the Apollo 13 flight. First, 
what was the cause of the flight failure of cryogenic oxygen tank 2. 
Second, what possible contributing factors during the ground history of 
the tank could have led to the ultimate failure in flight. 

The first flight indication of a problem occurred when the quantity 
measurement in the tank went full scale about 9 hours before the incident. 
This condition in itself could not have contributed to ignition in the 
tank, since the energy in the circuit is restricted to about 7 milli- 
j oules . 

Data from the electrical system provided the second indication of a 
problem when the fans in tank 2 were activated to reduce any stratifica- 
tion which might have been present in the supercritical oxygen in the 
tank. Several short-circuits were detected and have been isolated to 
the fan circuits of tank 2. The first short-circuit could have contained 
as much as 160 joules of energy, which is within the current -protect ion 
level of the fan circuits. Tests have shown that two orders of magnitude 
less energy than this is sufficient to ignite the polytetrafluoroethylene 
insulation on the fan circuits in the tank. Consequently, the evidence 
indicates that the insulation on the fan wiring was ignited by the energy 
in the short-circuit. 

The burning in the tank then proceeded, causing the tank pressure 
to rise to a peak, value of 1008 psi, about half of the predicted tank 
burst pressure at cryogenic temperature. At that time the relief valve 
opened, as expected, and decreased the pressure in the tank. The burning 
had progressed to the point by this time that all energized electrical 
circuits to tank 2 had shorted and opened. 

The next indication of a problem occurred when accelerometer traces 
in the command module showed vibration excitation with the largest ampli- 
tude along the longitudinal axis . This was apparently at the time that 
the integrity of tank 2 was lost and the vacuum dome relief plug blew 
out. The loss of tank pressure is concluded to have been caused by the 
failure of the electrical conduit tube when the fire progressed into the 
conduit. Tests under simulated conditions support this point of view. 

The only place the wiring comes close to, or touches, the pressure vessel 
is in the electrical conduit tubing at the top of the tank. To fail the 
tank at any location other than the electrical conduit, without burning 
metal inside, does not appear reasonable, particularly if only insulation 
is burning in zero g. 




Following the rupture of the conduit tubing, the tank 2 pressure re- 
mained above 880 psi to the point of data loss. If the tank pressure had 
decreased below 880 psi, the heaters would have come on automatically at 
that time. The heater circuits were energized during the data loss period. 
Consequently, the evidence supports the theory of a small opening in the 
tank venting into the bay which housed the cryogenic tanks. A fraction 
of a second after the conduit failed, the pressure immediately increased 
in the bay and blew the panel off. Thermal measurements show significant 
heating was present just before the panel separated which indicated there 
must have been an area burning exterior to the pressure vessel. A rup- 
tured tank that was dumping cold fluid would have caused a chilling of 
the temperature sensors. The data indicate that tank 2 remained in the 
bay and photoanalysts using sophisticated methods, believe the photo- 
graphs reveal that at least part of tank 2 remained intact. 

Many aftereffects resulted from the loss of tank 2 pressure integ- 
rity. Most significant were the eventual loss of tank 1 pressure and the 
loss of electrical power from two of the three fuel cells when the shock 
of the panel separating caused the oxygen supply valves to close. More 
important, however, was the fact that the condition was undetected since 
a warning is given to the crew only when both hydrogen and oxygen valves 
to a fuel cell are closed- Oxygen system 1 developed a leak either as 
the result of shock when the panel separated, or from the dynamics of the 
particular events associated with the failure of tank 2 electrical conduit. 

The cryogenic oxygen tank 2 could not be off loaded after the initial 
filling during the countdown demonstration test. The problem resulted 
from loose or misaligned plumbing components of the dog-leg portion of 
the tank fill path. Allowable manufacturing tolerances are such that the 
tank may not be detanked normally. A test has verified this fact. The 
condition of loose plumbing in the probe assembly, which existed in the 
tank before the detanking, was judged to be safe for flight in every 
aspect . 


The inability to perform a normal detanking operation during the 
countdown demonstration test led to the use of a special detanking pro- 
cedure. The special detanking procedures failed the tank heater thermal j 

switches .o the closed position. An incompatibility between the voltage . * 

output of ground power supply used for the heaters and the thermal switch 

capacity resulted in fusing the contacts when operating in this mode for 3 

the first time. This resulted in continuous heater-on times in excess ) 

of 8 hours, which went undetected prior to flight. This condition over- 
heated the insulation, causing major electrical wire insulation degrada- ' 1 

tion (splits and cracks). Several mechanisms could have moved the fan \ 

wiring and caused the shorted conditions which triggered the fire within 
the tank and finally caused the loss of all service module oxygen. 
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The main substance of the investigation of the cryogenic oxygen 
tank 2 anomaly is contained in this report. Additional information con- 
cerning the tank 2 manufacturing and checkout history, the details of 
the analyses , and the results of the special tests conducted in support 
of the investigation will be forwarded under separate cover. 


\ 
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3.0 PERTINENT DATA 


The significant system parameters for the period of interest are 
shown in figure 3—1. Bay 4 of the service module and the hardware 
mounted in this area are shown in figure 3-2. 

Approximately 9 hours prior to the period of interest, the quantity 
gage in cryogenic oxygen tank 2 failed to full scale during a fan cycle. 

At 55:53:20, the electrical fan circuits for cryogenic oxygen tank 2 
were energized. Approximately 2 seconds later, a momentary short was 
indicated in the current from fuel cell 3. Within several seconds, two 
other momentary shorted conditions occurred. 

The cryogenic oxygen tank 2 pressure increased from 880 to 1008 psi 
in approximately 90 seconds with a plateau at 1+0 seconds . The pressure 
then decreased to 995 psi in about 9 seconds. The fuel cell flow rates 
responded to the pressure profile. 

The. temperature in the tank rose rapidly during the final 25 sec- 
onds of the pressure rise, then the measurement failed. The quantity 
gage, which had previously failed, corrected itself and then failed 
again. 

The command module accelerometers responded to a vibration disturb- 
ance about h20 milliseconds after the last pressure reading and to an 
impulse about 3^0 milliseconds later. Approximately 1+0 milliseconds 
later, all data from the spacecraft were lost for about 1.8 seconds. 
Following recovery of the data, the spacecraft had experienced a trans- 
lation change of 0.1+ ft /sec primarily in a plane normal to the cryogenic 
oxygen tank bay. Cryogenic oxygen tank 2 pressure read zero. The cryo- 
genic oxygen tank 1 pressure was decaying rapidly, and its heaters were 
on. A main bus B undervoltage alarm and a computer restart were present. 
Several structural temperatures in bays 3 and 1+ were reading up to 8° F 
higher than before the data loss . 

The crew reported that they had heard and felt a sharp “bang," coin- 
cident with a computer restart and a roaster alarm associated with a main 
bus B undervoltage condition. Within 20 seconds, a quick check of the 
electrical parameters was made by the crew and all parameters appeared 
normal. However, the crew did report the following barberpole indica- 
tions : 

a. Service module reaction control system helium 1 on quads B and D 

b. Service module reaction control system helium 2 on quad D 

c. Service module reaction control system secondary propellant 

valves on quads A and C. 
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About 2-1/2 minutes later, fuel cells 1 and 3 ceased generating 
electrical- power. About 2 hours later, fuel cell 2 was turned off as a 
result of the pressure loss in cryogenic oxygen tank 1. 

Photographs taken after service module separation showed that the 
bay k panel was missing and that one high-gain antenna horn was damaged. 
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4.0 DATA ANALYSIS 

This section analyzes the significant events relative to the inci- 
dent involving cryogenic oxygen tank 2 and identified in section 3.0. 


4.1 QUANTITY GAGE 


The first anomalous inflight condition associated with the cryogenic 
oxygen tank 2 occurred at 46 : 40 : 06 when the ac-powered destratification 
fans in both cryogenic oxygen tanks were turned on. Within about 3 sec- 
onds after fan activation, the quantity measurement for cryogenic oxygen 
tank 2 abruptly indicated full-scale high. This system indicates density 
of the cryogenic oxygen by measuring its dielectric constant, which is a 
function of density. This instrument is a capacitor which consists of 
two concentric aluminum tubes inside the tank (fig. 4-1). 

Tests have shown that an open-circuit in the leads to the capacitor 
assembly or a short across the capacitor or its leads will drive the out- 
put to full scale. If this short-circuit is removed, the output signal 
drops abruptly from full scale to zero, and then in about a second, it 
settles out to the proper reading, as noted in the data of figure 4-2. 
This agrees with the flight data from the quantity probe. Tests also 
show that if the inner tube is shorted to ground, the output may oscil- 
late in a random manner. Such an oscillation was noted several minutes 
after data recovery following the incident. It should be noted that with 
a short-circuit in the quantity gaging system inside the tank, the maxi- 
mum current that could be drawn is 15 milliamperes . 


4.2 ELECTRICAL SHORTS 


The configuration of the electrical power system at the time of the 
incident xs shown in figure 4-3, and the configuration of the electrical 
power to the cryogenic oxygen tanks is shown in figure 4-4. As shown in 
figure 4-5, three separate shorting events occurred following application 
of power to the fan circuits in cryogenic oxygen tank 2. 

The ac bus 1 voltage dropped 1.2 volts and the dc current increased 
1.6 amperes when the cryogenic oxygen tank 1 fans were turned on 
(fig. 4-5). 


About 1.5 seconds later, when the cryogenic oxygen tank 2 fans were 
energized, the ac bus 2 voltage dropped 0.6 volt and the spacecraft cur- 
rent increased- 1.6 amperes. The thrust vector control gimbal command 






Figure 4-2.- Correlation of cryogenic oxygen tank 2 quantity flight data with measurement failure modes. 


























Figure 4-5.- Spacecraft current and ac voltage during period of interest. 


15 


data from the stabilization and control system indicated a corresponding 
voltage transient. Testing on the stabilization and control system has 
shown that a low voltage transient on ac bus 2 results in a transient on 
the gimbal command data. The ac bus 2 voltage decrease and the spacecraft 
current increase show that power was applied to the cryogenic ^xygen 
tank 2 fans (fig. *4-5) but does not indicate whether the fan motors were 
running, since the stall and running currents are essentially the same. 

The ac voltage decrease and the spacecraft current increase for the 
fans in each tank were normal and agree with data from previous cryogenic 
oxygen tank fan cycles. Also, the transient on the stabilization and 
control system data appeared during previous tank fans cycles. 

The first indication of a short on ac bus 2 appeared about 2-1/2 sec- 
onds after activation of the cryogenic oxygen tank 2 fans. The ac bus 2 
voltage dropped 1.2 volts, the fuel cell 3 current increased 11 amperes 
(fig. 4-5) , and the stabilization and control system gimbal command data 
experienced a transient. Subsequent to the short, the spacecraft current 
data show a decrease of 0.8 ampere from the level just prior to the short . 
Also, the ac bus 2 voltage started to toggle-up 0.6 volt, or one data bit 
(fig. 4-5). These data indicate that a load was removed from ac bus 2 
and that it was approximately one-half the load normally applied when the 
cryogenic oxygen tank 2 fans were turned on. This indicates that a short 
in one of the two fan motor circuits in cryogenic oxygen tank 2 caused 
its fuses to blow. 

The second indication of shorting occurred about 15 seconds later 
when phase A of ac bus 2 voltage increased 1.8 volts. Since the inverter 
attempts to maintain a constant average 3-phase voltage, this increase in 
phase A indicates a decrease on phase B or C of the ac bus 2 caused by an 
increased load. 

Approximately 200 milliseconds later, the ac bus 2 voltage momen- 
tarily decreased 11 volts (fig. 4-5), and the total spacecraft current 
increased 3.5 amperes, indicating an increased load. After the momen- 
tary decrease, the ac bus 2 voltage reading was 0.6 volt less than the 
previous indication. This could be an indication that a single phase 
short on phase B or C was removed by blowing a fuse. 

About 20 seconds after the first short, the third ac bus 2 short 
occurred. Fuel cell 3 current increased 23 amperes, and the stabiliza- 
tion and control system data again indicated a transient (fig. 3-1). 
Subsequently, the total spacecraft current level decreased to the same 
level as it was prior to turning on the cryogenic oxygen tank 2 fans. 

This indicates that power to the remaining cryogenic oxygen tank 2 fan 
was removed by blowing its fuses due to this short. Also, the ac bus 2 
voltage increased to the same level as that prior to turning the tank 2 
fans on (fig. 4-5). 
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The electrical energy that could, not he accounted for by normal 
spacecraft loads (fig. 4-5) is attributed to the shorts- Calculations 
were made of the maximum energy levels that could have been transmitted 
through the circuit during these shorted conditions and that would still 
meet the constraints imposed by the flight data resolution and sampling 
times, inverter performance, fuse clearing time, and dc and ac bus volt- 
age senior performance. Inverter performance and fuse clearing time tests 
were performed to provide data for the energy calculations. The energy 
calculations are summarized in table 4-1. 

The spacecraft current data show that the heaters were not on prior 
to the data loss . The heaters were set for automatic operation and the 
cryogenic oxygen tank 2 pressure switch was open, thereby preventing 
application of power to the heaters in either tank. In the automatic 
mode, the heaters in both tanks are energized simultaneously when the 
pressure switches for tanks 1 and 2 are closed (fig. 4-6). When data 
were reacquired after the incident, the spacecraft current indicated that 
heaters in one of the cryogenic oxygen tanks had automatically been ener- 
gized. For this to occur, the cryogenic oxygen tank 2 pressure must have 
dropped below the switch actuation point during the data loss. The 
tank 1 pressure was already below the switch actuation point. The cryo- 
genic oxygen tank 1 heaters came on because they were the only operative 
heaters when manually actuated later. The heaters use the same power 
circuitry to the tanks during manual and automatic operation. 

At about the time of the shock to the spacecraft, a master alarm 
and a main bus B undervoltage light were noted coincident with a computer 
restart. The voltage must decrease to below about 18 volts for at least 
15 microseconds before a computer restart will occur. This event would 
indicate a hard short on both main buses because the computer receives 
its power, through diodes, from both buses. An undervoltage light on 
main bus B only would be most probable because only one fuel cell supplies 
its power, while bus A power is supplied by two fuel cells. The win -i n bus 
voltage must be below 26 volts for longer than TO milliseconds for an 
undervoltage indication to occur. The most likely cause of such a low 
voltage for that length of time is a short on the wiring to the tank 
pressure switches that control the heaters (fig. 4-6), resulting from the 
cryogenic oxygen tank failure. This circuit receives power from both 
buses through 10-ampere fuses located in the service module. The short 
must have occurred after closure of the pressure switches which provide 
power to drive the motor switch, since the motor switch must close in 
order to apply power to the tank heaters in the automatic heater control 
mode. Cryogenic oxygen tank 2 heaters did not come on because the cir- 
cuits were open. 
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TABLE 4-1.- DELTA ENERGY CALCULATIONS 


AC 

current , 
amperes 

AC 

level , 
volts 

Watts 

DC 

amperes 

Time 

const vaints 

Total fault 
energy joules 

Single phase short 

0.2 

115 

23 

1 

13.6 sec 

313 

1.5 

111 

167 

9 

(2) 200 ms 

33 

2.0 

110 

220 

12 

(2) 200 ms 

44 

2.5 

109 

273 

14 

(2) 200 ms 

55 

3.0 

107 

321 

17 

(1) 120 ms 

39 

4.0 

105 

420 

23 

(1) 31 ms 

13 

5.0 

102 

510 

28 

(1) 20 ms 

10 

7.0 

95 

666 

36 

( 1 ) 10 ms 

7 

9.0 

75 

6 75 

37 

(l) 8 ms 

5 

12.0 

4 

48 

13 

(l) 4 ms 

0.2 

Two phase short 

0.1 

115 

11.5 

1 

13.6 sec 

313 

1.5 . 

111 

167 

' 14 

(2) 200 ms 

67 

2.0 

110 

220 

19 

(2) 200 ms 

88 

2.5 

109 

273 

23 

(2) 200 ms 

109 

3.0 

107 

321 

28 

(1) 120 ms 

77 

4.0 

104 

4l6 

36 

(1) 31 ms 

26 

5.0 

101 

505 

45 

(1) 20 ms 

20 

7.0 

80 

560 

58 

(1) 10 ms 

11 

9.0 

45 

400 

44 

(l) 8 ms 

6 

Three phase short 

0.07 

115 

7.7 

1 

13.6 sec 

313 

1.5 

111 

167 

22 

(2) 200 ms 

100 

2.0 

no 

220 

31 

(2) 200 ms 

132 

2.5 

109 

273 

39 

(2) 200 ms 

164 

3.0 

107 

321 

47 

( 4 ) 70 ms 

23 

4.0 

104 

4l6 

6 5 

(1) 31 ms 

39 

5.0 

101 

505 

84 

( 1 ) 20 ms 

31 


90 

630 

105 

(1) 10 ms 

19 


10 

90 

25 

(l) 8 ms 

2 
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4.3 CRYOGENIC OXYGEN TANK 2 PRESSURE TRANSIENT 


The interface of the cryogenic oxygen tank 2 with the oxygen system 
is shown in figure 4-7. 

The internal components of the tank and location of the wiring are 
shown in figure 4-8. The oxygen temperature is measured from within the 
tank as shown. Tank pressure is measured external to the tank in the 
valve module (fig. 4-9) and is sampled once per second. The pressure 
switch which controls the automatic heater circuits is attached to the 
valve module. 

The electrical data show that power was applied to both fan motors 
in cryogenic oxygen tank 2. It seems probable that one, and possibly 
both, fan motors came on, but this cannot be determined conclusively from 
the pressure data. Further, the electrical data confirm that the oxygen 
tank heaters were not energized. 

The time history of cryogenic oxygen tank 2 pressure variations dur- 
ing the last fan cycle can be divided into three regions (fig. 4-10). 

The first region is the pressure rise which began just after the fans 
were turned on and lasted for 40 seconds , when a distinct change in the 
pressure rise rate occurred. 

The. second region covers a 45-second time interval from the pressure 
plateau to the peak pressure of 1008 psia. The third region is character- 
ized by about a l4-psia pressure drop over a 9-second period, after which 
data were lost. A detailed discussion of the last 800 milliseconds before 
data loss is presented in section 4.7. 


4.3.1 Tank Pressure Data Analysis 

Since the pressure transducer is located in a flow line and not on 
the tank itself, an investigation was conducted to insure that the pres- 
sure data are, in fact, a valid indication of pressure in the oxygen 
tank. 

Tests on the sensor in the system show that the sensor will respond 
from zero to full scale in 5 milliseconds to a step input. The system, 
including the plumbing, has a response of less than 30 milliseconds. 

The transducer is located in the valve module (fig. 4-9), along with 
the relief valve, and is about 20 feet of line length from the tank cavity 
(fig. 4-7). The pressure measurement has been verified as representative 
of the actual pressure in the tank in two tests under dynamic conditions 



Figure 4-7. - Oxygen system. 













Figure 4-8.- Arrangement of components and wiring within oxygen tank. 













Figure 4-10. - Pressures, temperatures, and quantities during period of interest. 
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with flow-through the relief valve using simulated flight system hardware. 

With high pressure gas, the measurement given by the transducer was within 

18 psi of the actual tank pressure. With cryogenic oxygen, the trans- 
ducer reading was within 9 psi of the actual tank pressure. 

Another validation of the pressure transducer under dynamic pressure 
conditions consisted of integrating the flow rate change to the fuel cell 
(fig. 4-11). This calculation substantiated the tank pressure peak as 
about 1008 psia. Throughout the mission, both tank pressures were read- 
ing as expected, further substantiating their validity. 

The pressure rise rates shown in figure 4-10 can be described ana- 
lytically by various thermodynamic processes. All thermodynamic calcula- 
tions on pressure rise, heat input, mass flow, etc. were performed using 
data on the "real gas" properties. In the supercritical region, devia- 
tions from ideal gas relationships can be extremely large . 

The maximum energy input to satisfy the observed pressure rise is 
a constant density heating process. This condition is shown by the upper 
curve of figure 4-12. A second process, which establishes the minimum 
energy input, is an isentropic compression of the fluid. This compression 
is represented by all the energy input being confined to a ama.ll bubble, 
which has no mass. The resulting thermodynamic state is one of higher 
pressure in the tank. The result of this process is depicted by the lower 
curve of figure 4-12. 

In actuality, the energy input into the tank lies somewhere between 
the maximum and minimum energy input curves shown in the figure. The 
process is modeled by a hot oxygen bubble of constant uniform tempera- 
ture ; growing at a rate sufficient to isentropically compress the sur- 
rounding cryogenic oxygen. This formulation accounts for mass transfer 
both to the hot mass (to increase the volume) and from the hot mass (t ank 
outflow). This mass transfer requires a larger energy input to sustain 
the pressure rise. The center curve of figure 4-12 shows a comparison 
of this model with the maximum and minimum energy models. The results 
(fig. 4-13) are dependent upon the temperature of the hot mass. Note 
that while the energy input increases by approximately 300 percent, the 
hot mass volume changes only 10 percent. Therefore the energy source is 
confined to a small region within the tank, and is essentially independ- 
ent of the temperature of the burning material. 
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4.3.2 Region I and II Analysis 

There are only two plausible mechanisms for the slope changes on 
the pressure— time curve during regions I and II: a change in the mass 
outflow characteristics or a change in the energy input characteristics. 
Several analyses were performed in an attempt to relate changes in mass 
outflow characteristics to the pressure curve. These studies show that 
the only reasonable explanation for the observed pressure characteris- 
tics is a rapidly changing combustion rate within the tank. 


4.3.3 Region III Analysis 

Region III is the portion of the pressure-time curve that is de- 
creasing quite rapidly, from 1008 psia to 996 psia in about 9 seconds. 

The analysis of the events in this time period must necessarily include 
a discussion of the relief valve characteristics. The acceptance test 
of this relief valve showed the valve started to open at 1004 psia and 
was fully open at 1005 psia. The relief valve flow capability, which has 
been established by test, is much greater than the flow rate required to 
produce the observed pressure decay in region III (fig. 4-l4). In fig- 
ure 4-15, note that the relief valve has the capability to relieve the 
pressure more rapidly than observed, even considering that the energy 
input is increasing exponentially. 

There are at least two possible ways to explain the observed pres- 
sure response. One is a partial restriction of the flow and the other 
is a change in the combustion rate within the tank. There are several 
conditions which could lead to partial restriction of the flow, but the 
simplest of these is a restriction in the relief valve itself. 

A change in the combustion rate could easily account for the slower- 
than-expected pressure decay after the relief valve opened. In order to 
properly account for the increase in combustion rate, it is necessary to 
consider about the last 2 seconds of region II. At this point, the pres- 
sure is 1004 psia, the relief valve crack pressure. When the relief 
valve opens, the velocity at the filter (inside the oxygen tank) increases. 
It is hypothesized that this increase in velocity provides both a convec- 
tive force field and additional oxygen to the combustion source. When the 
relief valve opens fully the local velocity increases to a maximum. A 
further postulation is that this yields a maximum burning ‘ate which raises 
the pressure to 1008 psia. The relief valve flow then deceases the pres- 
sure, although the combustion rate remains high. A heat input rate of 
approximately 2 Btu/sec will raise the pressure from 1004 psia to 1008 psia 
with the relief valve open. A constant heat rate of approximately 1-1/4 
Btu/sec will match the observed pressure decay in region III (fig. 4-15). 
This energy input rate is about two and one— half times larger than the 
exponential rate of region II. 
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When data were recovered after the incident, the cryogenic oxygen 
tank 2 pressure indication was at the lower limit, which means that either 
the pressure at the transducer was , in fact , zero or that the measurement 
had failed electrically. The pressure reading would go to zero if the 
feedline_f ailed or the pressure in the tank was zero. 


4.3.4 Cryogenic Oxygen Tank 1 Pressure Decay 

An analysis was conducted to determine what hardware damage was re- 
quired to explain the loss of oxygen from cryogenic oxygen tank 1. Fig- 
ure 4-16 compares the cryogenic oxygen tank 1 pressure decay with the 
pressure decay rate computed, assuming choked flow. Also, cross-plotted 
on this figure are the integrated flow-rate curve and the quantity gage 
data. This latter curve tends to substantiate the analytical approach. 
The analysis yields an effective flow area of approximately 0.005 in^. 
This area is of the same, order as the line on the pressure switch; a 
flow area this small could also result from a crimp in any of the lines 
from cryogenic oxygen tank 1. 


4.4 CRYOGENIC OXYGEN TANK 2 TEMPERATURE 


While the pressure was rising sharply in cryogenic oxygen tank 2, 
changes occurred in the temperature indication (fig. 4-10). The tempera- 
ture data are obtained from a sensor located on the quantity probe assembly 
(fig. 4-8) within the tank. The temperature increased about 2° F during 
the first pressure rise (region I). A temperature increase of this magni- 
tude is in accord with that expected due to the pressure rise alone. 

The significant aspect of the temperature data is the rapid rise 
rate commencing approximately 24 seconds prior to loss of data (fig. 4-10). 
Several analyses were performed to interpret the data. The results indi- 
cated that a temperature range of 600° to 2900° F could produce the ob- 
served response. This wide temperature span is a result of the geometric 
configurations which are possible. The significant results from these 
analyses confirmed that the combustion source was near the sensor during 
the period of rapid temperature rise. Just prior to the loss of data, 
the temperature dropped to zero, indicating an open circuit failure in 
the measurement circuit. 


O 0.084 inch diameter Isentropic flow 

O 0.076 inch diameter Orifice — 1 



Figure 4-16.- Pressure decay rate comparison 
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4.5 PHOTOGRAPHIC ANALYSIS 


4.5.1 Photographic Data 

The photographic data used in this analysis included onboard photog- 
raphy of the service module taken by the crew after the service module 
was separated from the command module. The onboard photography was of 
marginal quality and included the following: 

a. Twenty-six frames of 70-mm (magazine N) SO 368 Ektachrome MS 
color film, using the Hasselblad hand-held camera with the 250-mm lens 

b. Forty-three frames of 70-mm (magazine R) 3400 Panatomic X black 
and white film, using the Hasselblad hand-held camera with the 80-mm lens 

c. Nineteen frames of l6-mm (magazine FF) SO 368 Ektachrome MS color 
film, using the hand-held motion picture camera with the 75-mm lens. 

The average distance from the Hasselblad cameras to the service mod- 
ule for the onboard photography was about 410 feet for magazine R and 
about 880 feet for magazine N, resulting in. an image scale of 1:1500 and 
1:1077, respectively. Of the frames showing the service module, orienta- 
tion was such that the majority do not show bay 4, and at no time are the 
sun angle and camera view simultaneously directed into bay 4. 

In an effort to draw detail out of the high density in the area of 
the normal location of the cryogenic oxygen tank 2 in bay 4, two black 
and white frames (AS13-59-8500 and -8501) and three color frames 
( AS13-58-8462 , -8464, and -8465) were subjected to photographic process- 
ing enhancement for specific details. These same frames were also sub- 
jected to electronic scanning with an image digital construction tec - 
nique similar to that used on the Surveyor lunar surface photography 
Assisting the Photographic Technology Laboratory at the Manned Spacecraft 
Center were the Jet Propulsion Laboratory, McDormell-Douglas Corporation, 
LogEtronics Incorporated, Ciba Corporation, and Data Corporation with 
their specialized techniques, facilities, and experienced personnel. 

After exhausting all means of enhancement from the masters , the original 
film was taken to Data Corporation, Dayton, Ohio, to be scanned with 
their high-intensity , 1-micron probe and digitally reconstructed to bring 
out the detail for analysis. 

Without the benefit of sharp, well-lighted views of the bay 4 area, 
such as are available in the preflight closeout photographs, it was nec- 
essary to obtain all the available information from each of the better 
frames and then to combine the findings . This approach was also used in 
examining the transparencies and prints of individual frames at each 
stage of enlargement and enhancement. 
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In addition, the contact and enlarged transparencies, combined with 
the digitized enhancements . showed where the Ifylar /Kapton was blocking, 
or shadowing, to hide certain component areas. The information was re- 
constructed into a scale model, which confirmed the presence of hard 
point components presenting different reflective surface, such as the 
oxygen and hydrogen tank surfaces, as well as the influence of the %lar/ 
Kapton highlights and blacks. 


4.5*2 Onboard Photography Analysis 

Figure 4-17a shows cryogenic oxygen tank 2 as it appeared at the 
time of bay 4 closeout and figure 4-17b identifies the features shown. 

Figure 4-l8a shows frame 8464 of the 70-mm color film taken through 
the window of the lunar module. Figure 4-l8b identifies the principal 
features. Figure 4-19a shows frame 8501 of the 70-mm black and white 
film and the principal features are identified in figure 4-19b. 

Figure 4-20 shows the 1/6 scale model with fuel cells tipped, M(ylar 
and Kapton insulation extended, skin panel removed as in frame 8464, but 
with a bright metal oxygen tank having a clean Inconel— type surface. Fig— 
4—21 shows the 1/6 scale model the same as in figure 4—20 except with 
cryogenic oxygen tank 2 discolored brown. Figure 4-22 shows the same 
1/6 scale model except with oxygen tank 2 removed. 

Figure 4-18 and 4-19 are representative of the best onboard photog- 
raphy analyzed by stereo plotter, monocular photographic interpretation, 
enlarging and enhancement, electronic scanning and digitizing, and by 
model simulation. The results indicate the following: 

a. The fuel cells (l and 3) are tipped slightly forward (outboard) 
so the rear of the fuel cell shelf apparently was raised. 

b. The insulation blanket was removed from the underside of the 
fuel cell shelf near radial beam 3 and above oxygen tank 2, since the 
color of the bare shelf is visible. 

c. Mylar and Kapton insulation blown, torn, and/or partially burned 
free from its initial fastening, now congest some areas of the bay and 
extend outside the service module from several places along the edges of 
shelves and beams . 

d. The oxygen tank 2 appears to be present and discolored. Because 
of the blackness of the non-illuminated remaining interior, aluminized 
Mylar and Kapton, and the discoloration of the oxygen tank 2, the blend 


of brown.and black does not show on photographic prints and is only dis- 
cernible by subtle color change in the enhanced transparencies of frame 
8465 which provides the most direct look into the unlighted area of the 
oxygen tank in bay 4. 

e. The electrical cable to cryogenic oxygen tank 2 is identified 
by its length and point of attachment to the oxygen shelf. The tank 
attachment free end extends upwards and outwards from the shelf 

(fig. 4-19). 

f. Reflections from the end domes, body, and some connections on 
the hydrogen tank indicate it is apparently externally sound and in proper 
position. 

g. A portion of the bay 4 panel remained attached at the forward 
end by radial beam 3, and the lower access panel remained attached to 
the service module at the aft end of beam 3. 

h. One of the four reflectors and feeder horns for the high-gain 
antenna was damaged. The attitude of the antenna, with the damaged re- 
flector nearest the service module, had changed since the incident be- 
cause the gimbals are free to rotate whenever the power is turned off. 

i. The oxygen service panel appeared in its normal position, but 
with considerable loosened tyylar and Kapton in the area. 

J. A brown stain was observed on the outside surface of the service 
propulsion system engine nozzle extension, near the plus Z axis, and in 
line with the vent path from the vent annulus around the nozzle. 


4.5.3 Ground Photography 

Three of the observatories tracking the spacecraft took photographs 
of a nebulosity or cloud that appeared shortly after the incident. 

Such a cloud, having a maximum measured diameter of 25 nautical 
miles, appeared on a photograph from the Manned Spacecraft Center l6-inch 
telescope at approximately 56 hours . 

Analysis of a photograph taken through the telescope at Mount Kobau 
Observatory, British Columbia, at 58 hours 27 minutes, about 2-1/2 hours 
after the incident, indicated that approximately 20 pounds of oxygen 
would be required to form the observed cloud. The characteristics of 
cloud shape and axes alignment indicate that it was not formed by an in- 
stantaneous release of oxygen. 
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(b) Identification of features in figure 4-19a. 


Figure 4-19.- Concluded 



fv 



Figure 4-20.- Model with lighting similar to onboard frame 8464. 











4.6 SERVICE MODULE BAY 4 PANEL SEPARATION 


This section discusses the sequence of events immediately preceding, 
during, and immediately following the separation of the outer shell panel 
from bay 4 of the service module. A description of the associated struc- 
ture and its failure mode is presented first , followed by a discussion 
of the cryogenic oxygen tank 2 structure and how it might fail. Next, 
the events occurring during the last second of data prior to the incident 
are discussed. 


4.6.1 Bay 4 Structural Descri ptio n 

Bay 4 of the service module with the exterior shell panel removed, 
is shown in figure 3-2. The exterior shell panel is bonded aluminum 
honeycomb 1-inch thick; the exterior facesheet is 2024-T81 (0. 020-inch 
thick over most of the panel with a triangular section of 0.0l6-inch 
thickness at the upper end), the interior facesheet is 7178-T6 (0.010- 
inch thick), and the perforated core is 5052-H39 ( 3/16 by 0.0007-inch. 

2.2 lb/ft 3 ). 

The panel has several small doors , for servicing the tanks and fuel 
cells located in bay 4, and one large door located in the lower left-hand 
corner of the panel as viewed from the service module exterior. The 
panel is fastened at the periphery by 1/4-inch bolts (NAS 1134c) on approx 
imately 2-inch spacing and to the three shelves (fuel cell, oxygen, and 
hydrogen) by bolts at each shelf. 

Bay 4 is enclosed at the top by the 1-inch thick aluminum honeycomb 
service module forward bulkhead and at the bottom by the 3-inch thick 
aluminum honeycomb aft bulkhead. Radial beams 3 and 4 bound the left 
and right sides of bay 4, respectively, as viewed from the service 
module exterior. Bay 4 is open to the center tunnel except for three 
areas. One 0.032-inch sheet extends 18 inches from the forward bulkhead 
and one 0.020-incn sheet extends between stations X 933 and X 942. The 
inner radial beam caps are laterally supported. a a 

Three shelves are made of aluminum honeycomb and have the following 
construction : 

a. Fuel cell - Two inches thick with 7178-T6 facesheets chemically 
milled to 0.020 and 0.035 inch. The core is 3/16 by 0.0015 inch. 

b. Oxygen - Two inches thick with 7075-T6 facesheets of 0.030 to 
0.060 inch. The core is 3/16 by 0.003 inch. 

c. Hydrogen - One and one-half inches thick with 7075-T6 facesheets 
of 0.015 inch. - The core is 3/16 by 0.0015 inch. 


Insulation consisting of 28 layers of 0. 15-mil aluminized Mtjrlar 
sandwiched between two layers of 0. 50r.mil aluminized Kapton is attached 
to specific bay 4 surfaces with Velcro patches. The insulation is lo- 
cated on the tunnel section of the fuel cell bay, on the beams, and 
shelves of the cryogenic bays , and on the panel from the aft bulkhead 
to the fuel cell shelf. 


4,6.2 Bay 4 Panel Structural Behavior 

The bay 4 panel may be structurally idealized as a cylindrical shell 
segment supported elastically at its boundaries. The radial beams pro- 
vide support in the axial and radial directions along the meridians of 
the panel. Tangential support along those boundaries is provided by the 
adjacent shell panels which are supported by the forward and aft bulkheads, 
Ths forward and aft bulkheads provide radial and circumferential support. 

The panel and radial beams have 5/l6 and 9/32 inch attachment holes, 
respectively, with large tolerances to allow removal and reinstallation 
of the panel when the spacecraft is on the launch pad. The wt».yt mum free 
movement at a single bolt would be 0.0975 inch considering the naximum 
dimensions of the hole in the panel and radial beam and the minimum bolt 
diameter. 

Two simplified limiting cases may be used to describe the basic 
structural behavior of the panel. The first considers the panel as a 
flat plate supported on all edges. In this ease the panel transfers 
loads to the boundary by bending. The second case considers the panel 
as a pure membrane which transfers loads into attachments by in-plane 
extension. The photographs of the service module show failure at the 
attachments along all the boundaries except for a small piece of struc- 
ture (approximately 6 by 4 inches) in the upper left-hand corner (viewed 
from the exterior). If the panel behaved as a flat plate and failed 
cleanly at the attachments, the bolts would fail in tension at approxi- 
mately 5100 pounds per bolt. This load or the bolt would require a 
shear load in the adjacent core of 785 pounds /inch which is greater than 
3 times the core-failure load. Since no facesheet nor core is evident 
along the edge, the structure did not behave as the simplified model of 
a flat plate. 

Because of the evidence which suggested primarily membrane behavior, 
simplified representations of the structure were used to investigate its 
behavior • Structural analyses were performed for numerous pressure dis- 
tribution as well as for temperature gradients for both hot and cold 
inner facesheets. The results show that the peak pressure must exceed 
20 psi and that temperature gradients of interest result in smv.ll edge 
loads. The static allowables for failure with a failure mode cf shear 
tearout are shown in figure 4-23. 


20° Axis of 
rotation 




4.6.3 Cryogenic Oxygen Tank 2 Structure 


The cryogenic oxygen tank is fabricated from Inconel 718 and is com- 
posed of two hemispheres assembled by fusion welding. A sketch of the 
tank is shown in figure 4-24. The basic wall thickness of O.O59 inch 
with increasing thickness at the welds and boss areas. The inside radius 
is 12.528 inches. The limit design pressure (maximum operating pressure) 
is 1025 psi, proof pressure is 1367 psi, and design burst pressure at 
ambient temperature is 1538 psi. Structural analyses have predicted a 
positive margin at design conditions; burst tests using liquid nitrogen 
demonstrated burst strengths in excess of 2200 psi. Preflight fracture 
mechanics analysis of cryogenic oxygen tank 2 predicted that no flaw prop- 
agation would occur until a pressure of 1050 psi was reached and that the 
failure mode at pressures less than 1240 would be leakage. 


4.6.4 Cryogenic Oxygen Tank 2 Fracture Mechanics 

Figures 4-25 and 4-26 show the fracture mechanics data of the cryo- 
genic oxygen tank. For the base material and the weld, as well as for 
heat— affected zone materials, the mode of failure is leakage at pressures 
up to those above proof pressure* 

Cryogenic oxygen tank 2 was operating well within the fracture mec- 
hanics limits for sustained flaw growth; hence, neither leakage nor rapid 
fracture- would be expected due to propagation of pre-existing flaws under 
the influence of pressure alone. Test data indicate that the addition of 
polytetrafluoroethylene combustion products to oxygen, and the immediate 
exposure of the mixture ti» a moderately stressed flaw, generated no de- 
tectable evidence of rapid sustained- load flaw growth. 

Localized heating of the tank material is the probable mode of the 
loss of tank pressure integrity and is supported by all known test analy- 
ses and by telemetry data. Considering that only polytetrafluoroethylene 
was burning in the tank, then the only place where the polytetrafluoro- 
ethylene comes close to, or touches, the pressure vessel wall is in the 
electrical conduit. Tests of burning Insulation in the electrical con- 
duit shows that in a few seconds the generated heat fails the tube. Fol- 
lowing the tube failure, the pressure in the annulus region would rapidly 
rise until the exterior shell burst disk (approximately 3 square inches) 
would rupture at approximately 80 psia. 




Cryogenic oxygen tank, pressure vessel. 
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**•6.5 Significant Structural Events 

The following interpretation and judgement of the most probable se- 
quence of events are based on all applicable data in the 0.80-second 
time period prior to the loss cf data (figs, 4-27 and 4-28). 

At 55:54:52.763 the last pressure data from tank 2 were recorded as 
996 psia and the pressure was rapidly decreasing. The fuel cell flow- 
meters were responding accordingly. Beyond the last pressure point, the 
pressure can be interpreted from fuel cell flow rates (fig. 4-28). Note 
the flow rates gradually decreased and then started to increase slightly. 
This can be interpreted to mean that the relief valve closed or that the 
burning rate increased. 

The data at the following times are interpreted to be the first loss 
of pressure system integrity, and the vibration experienced during this 
time period is interpreted to be due to venting of the tank through the 
vacuum annulus. 

a. At 55:54:53.182 command module accelerations in the X, Y, and Z 
axes indicated response of less than 0.5g, O.lg, and 0.25g peak to peak, 
respectively, with an estimated frequency of 15 to 25 hertz. 

b. At 55:54:53.204 the stabilization and control thrust vector con- 
trol command in pitch and yaw indicates an oscillation of approximately 
18 to 20 hertz, which is increasing with time. The results of full- 
scale testing of the docked command and service modules and lunar module 
to determine guidance and navigation transfer function were reviewed, as 
were the analytical mode shapes. These data revealed a mode at 18.76 
hertz which exhibited the characteristic of motion in the area of the 
oxygen tank and rotational displacement at the rate gyros • Assuming 

1 percent critical damping, the minimum harmonic forcing function was 
calculated to be 325 pounds at 18.76 hertz. The analysis shows that a 
forced vibration was present during this period. 

c. At 55:54:53*271 the flow rate to the fuel cells reached a peak 
value. Based on the last pressure reading and the integration of the 
flow rates, the oxygen tank pressure at this time is estimated to have 
been less than 996 psia. 

d. The next data from the fuel cell flow rate show a decrease , and 
may be interpreted as a change in the venting area from the initial indi- 
cation of a leak. However, changes in the hydrogen flow meters at the 
same time place doubt on the meaning of the dropoff. Such a decrease 
could come from increased oxygen flow because of expulsion of the wiring 
rrcm the controlling area or an extension of the original leak area due 
to increasing temperature. 
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Figure 4-27. - $ igmficant data immediately prior to data loss. 
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Figure 4-28. - Accelerations and fuel cell flow rates during period of incident 
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Based on spacecraft current data measured at 55 : 54 : 53 . 472 , the 
heaters did not come on and tank 2 pressure was above 878 psia, the 
heater-on point. 

At 55:54:53.511* the command module X-axis accelerometer indicated 
minus 0.56g (fig. 4-27). This is interpreted as the start of the rapid 
pressurization of the bay. The Y and Z axis accelerometers responded 
20 milliseconds later. 

At 55:54:53.555* the data loss began. Based upon the damage noted 
in the photographs , this is interpreted as an impact by the separated 
bay 4 panel on the antenna. 

a. The panel was subjected to a rapid overpressurization. To be 
consistent, with the structural mechanics, the available strength, and 
the observed evidence, the peak pressures are estimated to have exceeded 
20 psi. 


b. An analysis of the kinematics and dynamics of the panel was per- 
formed. It was assumed that the panel failed very quickly and that con- 
tact of the panel and the high-gain antenna was limited to the damage 
observed to only one of the antenna dishes . The position of the antenna 
is shown in figure 4-29* The results of this analysis determined a re- 
quired axis of rotation of the panel (fig. 4-23). Assuming a constant 
location of the line of action of the applied force, an approximate center 
of pressure can be located. 

c. The foregoing analysis is consistent with the available strength 
(fig. 4 - 23 ). The axis of rotation required to satisfy the kinematics of 
panel separation, the available strength, and the photographic evidence 
support the origin of failure on the .left side of the panel as viewed 
from the exterior. The response of the Y and Z axes accelerometers noted 
at 55 : 54 : 53*531 is consistent with a minus Y and minus Z force applied 
over 15 to 20 milliseconds. Analysis of the vehicle dynamics indicates 

a 900 to 1500 lb-sec impulse was experienced by the spacecraft. Such an 
impulse would require an initial total force greater than 60 000 pounds. 
The variation in strength with a failure mode of shear tearout in the 
panel is shown for loads applied perpendicular to the boundary. The 
allowable load applied parallel to the boundary is bounded by shear of 
the fastener at approximately 2200 lb /in. 

Evidence of pressure and heat in the bay is indicated from the re- 
sponse of the temperature measurements discussed in section 4.7. The 
response of a measurement located on the outboard side of the oxidizer 
storage tank in bay 3 confirms failure of the web of radial beam 3 . 

Damage to the beam caused the shifting of the fuel cell shelf. 



4-29.- Antenna configuration at the time of the incident. 
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Separation of the panel induced high shock loads to the service 
module as the attachments failed along the boundary and at the bay 4 
shelves. This shock closed the reactant valves in the fuel cell oxygen 
system, as well as several reaction control propellant isolation valves. 

Either the tank 2 feedline or the pressure transducer wiring or 
plumbing was severed during the loss of data. This explains the zero 
reading of low scale on tank 2 when data were recovered at 55:54:55.763. 
Figure 4-30 shows the plumbing and wiring on the oxygen shelf which were 
functional following data recovery. The figure also shows the location 
of the electrical leads to tank 1. After the event, the quantity and 
temperature sensing systems, heaters, and fans operated. The operation 
of these circuits and the location of the wire bundle of tank 1 with re- 
spect to tank 2 suggests there was no electrical damage associated with 
the loss of tank 2 pressure. Further, the motor-operated switch box 
through which all heater power goes for both tanks was still perative. 


4.7 THERMAL EFFECTS ON SERVICE MODULE 


Prior to the incident, all temperature transducers responded as ex- 
pected. At the time of the incident the following measurements 
(fig. 4-31) indicated abnormal temperature responses: 

(a) Bay 3 oxidizer storage tank surface 

(b) Service propulsion helium supply line on bay 3 side of beam 3 
at the inner edge of the beam 

(c) Bay 3 reaction control quad C helium tank 

(d) Fuel cell radiator glycol outlet lines on beam 4 in bay 4 

(e) Fuel cell radiator glycol inlet lines or beam 4 in bay 4. 

The bay 3 oxidizer tank surface, temperature increased from 73.4° 
to 77-7° F in about 20 seconds (fig. 4-32). The temperature then de- 
creased to 60° F about 2-1/4 hours later. Data received during the two 
command and service module power-up cycles at 101:55.54 and 123:05:25 
showed 60° and 65.3° F» respectively. The rise rate of bay 3 service 
propulsion system oxidizer surface temperature is indicative of direct 
heating in the vicinity of the transducer, which is attached to the tank 
skin and covered with 30 layers of insulation. 

Heat inputs to the bay 3 service propulsion tank surface transducer 
depend on the thermal integrity of the multilayer insulation blanket 
covering the transducer. To obtain the noted response requires severely 
degraded insulation, probably because of burning of the insulation or 
pressurization of the bay with hot gas. 



Structural integrity 
validated after incident 















(b) View looking inboard of bay 3. 
Figure 4-31*- Continued. 





(c) View looking inboard of fuel cell shelf. 
Figure 4-31.- Concluded. 
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Figure 4-32. - Bay 3 and 4 structural temperatures. 
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The service propulsion helium line temperature (fig. 4-32) increased 
from 84.6° to 89° F in about 37 seconds. In 2 more minutes, the tempera- 
ture had increased to 92.2° F. A gradual cooling trend followed, aud- 
io minutes later, the temperature had decreased to 83.4° F. During the 
two command and service module power-up cycles at 101:55:54 and 123:05:19, 
the helium line temperatures were 72.1° and 65.9° F, respectively. The 
initial rise rate is again indicative of direct heating in the vicinity 
of the transducer. However, unlike the oxidizer tank surface temperature, 
the gradual decrease in helium line temperature, after the initial rise, 
is indicative of a cool-down response to radiant heat loss. The helium 
line cooled gradually because of the lower temperature levels with the 
fuel cells shut down and the bay 4 panel missing. 

Bay 3 reaction control read C helium tank temperature (fig. 4-29) 
rose from 79*7° to 8l° F in about 10 seconds. The temperature continued 
to rise to approximately 83° F about 5 minutes later, th.-n it gradually 
decreased to 8l.6° F. 

Although all fuel cell radiator glycol inlet and outlet temperatures 
showed perturbations, the fuel cell 3 radiator inlet temperatures exhibit- 
ed the largest response. The temperature increased from 93.1° to 97.4° F 
in 3 seconds or less. This represents the highest response rate noted 
from any of the transducers at the time of the incident. The data for 
fuel .cell 3 radiator -inlet temperature, and for other transducers, are 
shown in figure 4-33. A correlation of these data has been performed and 
it is concluded that these transducers could have been exposed to a sud- 
den change in temperature environment prior to the data loss . An extrapo- 
lation can be made which would supj art the response noted at the time of 
the heat pulse (fig. 4-33), but it would depend on the heat input function. 
Tests performed with the temperature sensor installed on the glycol line 
and with glycol flowing indicate that the heat pulse would lead the rise 
point by about 0.25 second. The rise point can reasonably be extended to 
any time during the data loss. Assuming the rise point started at the 
time of the data loss , then the heat pulse would have started at approxi- 
mately the same time as the accelerometer disturbances , indicating that 
the high heating rate started before the bay 4 panel separated. The data 
indicate that the high-heating environment extended throughout bays 3 and 
4. 


4.8 SPACECRAFT DYNAMIC RESPONSE 


At the time of the incident, spacecraft attitude control was being 
provided by the digital autopilot in the primary guidance, navigation, 
and control system. At 55?51 j 23 an automatic maneuver had been initiated 
to the attitude specified for observation of the Bennet Comet, and the 
spacecraft was rolling at 0.2 degree/second. All reaction control system 
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quads were enabled for pitch and yaw and quads A and C for roll. No en- 
gines were firing at the tine of the incident. All guidance and control 
system equipment was powered up except the optics. 

The stabilization and control system recorded the small body rate 
oscillations described in section 4.6, at 0.28 second before the loss of 
data. When data were regained, negative rates were present in all three 
axes (fig. 4-34). The oscillations shown in the pitch and yaw axes on 
the figure are predominantly due to excitation of the first bending mode 
(2.7 hertz). The reaction control engine firings which occurred following 
resumption of data were proper for the conditions that existed. The re- 
sulting angular accelerations in pitch and roll, however, indicate that 
only one thruster was acting in each axis and that quad C was inoperative. 
The total attitude change was small (fig. 4-35). 

The loss of data precludes an accurate estimation of the character 
of the torque applied; however, the net change in angular kinetic energy 
was approximately 90 ft -lb. 

The inertial measurement unit accelerometers recorded a net .velocity 
change of 0.4 ft/sec, predominantly in the vehicle Y-Z plane. An accurate 
assessment of the direction of the force cannot be made because the mag- 
nitude is at the one or two data bit level (0.18 ft/sec/bit). Assuming, 
however, that the measured velocity change was accurate and that thruster 
firings did not degrade the measurement, the net change in translational 
kinetic energy was approximately 250 ft-lb. 

Venting followed the incident and attitude control was maintained 
automatically by the digital autopilot until the loss of main bus B when 
the last minus pitch thruster was disabled. Periodic attempts were made 
to reestablish attitude control manually using the thruster emergency 
coils until the thrusters were reconfigured to main A. The venting dis- 
turbance torque is shown in figure 4-36. Figure 4-37 contains a time 
history of network doppler data and shows the effect of venting as well 
as uncoupled thruster firings . 


4.9 LOSS OF TELEMETRY DATA 


Prior to the incident, the spacecraft was transmitting and receiving 
the S-band signals through the high-gain antenna, which was operating in 
the auto-track and narrow beam mode. Immediately before the incident, 
the high-gain antenna was pointing along the line-of-sight shown in 
figure 4-29. 

At 55:54:53.57 all ground station receivers lost phase lock because 
of a sudden interruption of the 3ignal. Two-way phase lock was regained 
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Figure 4-35. - Spacecraft dynamics during period of interest. 
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at 55:54:54.12. As shown in figure 4-29 , the received carrier power in- 
creased to a level consistent with receipt of good quality high bit rate 
telemetry data through the Goldstone 210-foot antenna at 55:54:55.37. 

The data indicate that the interruption of signal was caused by the 
physical damage to one of the four high-gain antenna dishes required for 
the narrow beam mode. The data also indicate that the high-gain antenna 
automatically switched to the wide beam mode. 


4.10 LOSS OF FUEL CELL PERFORMANCE 


Three fuel cells are located in bay 4 of the service module 
(fig. 3-2). Each fuel cell consists of a cell stack, hydrogen and oxygen 
control systems, a water removal system, and a thermal control and heat 
rejection system (fig. 4-38). 

Following the incident, the fuel cell 1 regulated nitrogen pressure 
indication was at the lower limit of the measurement. The nitrogen regu- 
lator is internally referenced to vacuum and maintains an absolute level 
of the nitrogen gas over the full range of fuel cell operating conditions 
The regulator vents downstream pressure to maintain control of overpres- 
sure. The oxygen and hydrogen regulated pressures, which are referenced 
to the nitrogen system pressure, remained normal after the loss of indi- 
cated nitrogen pressure, confirming that proper nitrogen pressure was 
maintained by the regulator.' Consequently, there was a loss of the in- 
strumentation during the data dropout period. 

About 2.5 minutes after the loss of pressure in cryogenic oxygen 
tank 2, the regulated oxygen pressures for fuel cells 1 and 3 decreased 
to nitrogen system pressure levels such that these fuel cells could no 
longer support a load. 

The oxygen and hydrogen regulators are similar in operation to the 
nitrogen regulator. The regulators maintain the reactant pressure at a 
constant level above the nitrogen reference pressure over the full range 
of gas consumption — from zero flow to full power operation plus purge. 
The oxygen and hydrogen pressure must be maintained at a minimum of 2 psi 
above the nitrogen reference pressure to prevent the electrolyte solution 
(aqueous potassium hydroxide) from crossing the electrode interface 
(fig. 4-39) and causing loss of fuel cell performance. Figure 4-40 shews 
the pressure decay at which point the fuel cells were flooded, causing a 
subsequent loss of performance. 

The pressure decays on fuel cells 1 and 3 were caused by closure of 
the fuel cell oxygen reactant shutoff valves. When the valves closed, a 
volume of high pressure oxygen was trapped between the reactant valves 



Figure 4-38.- Typical fuel cell schematic. 
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Figure 4-39.- Typical fuel cell functional diagram. 
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and the fuel cell oxygen regulators. This oxygen was sufficient for fuel 
cell operation for about 2.5 minutes, the time required to deplete the 
trapped supply. The agreement between the calculated and actual operat- 
ing time after valve closure (fig. 4-4o) verifies that fuel cells 1 and 
3 were starved of oxygen and eventually could not support an electrical 
load. 

Impact tests on the oxygen solenoid valves (fig. 4-4l) show that a 
shock in excess of 86g for 11 milliseconds duration can be expected to 
cause valve closure under operating conditions. 

The presence of a shock is further verified by the fact that the 
service module reaction control valves on quad C were closed. These 
valves can be switched closed at levels of 80g in 10 milliseconds. 

Plight experience has frequently shown a closure of one or two of the 
reaction control isolation valves when the service module is separated 
from the adapter panels; an explosive charge is used to sever the skin 
attachment . 

The crew did not receive an indication of the shock closure of the 
solenoid valves since the hydrogen and. oxygen solenoid valve "talkback" 
indicators are electrically connected in series for each fuel cell. The 
detection system, therefore, will show "barberpole" only when both the 
hydrogen and oxygen valves are closed for a fuel cell and not for closure 
of either valve. 

Fuel cell 2 performance was normal before and immediately after the 
period of data loss . When fuel cells 1 and 3 were removed from the buses , 
fuel cell 2 assumed the total spacecraft electrical power load of approxi- 
mately 60 amperes. Fuel cell 2 continued to operate normally until approx- 
imately 57 hours 46 minutes when the oxygen tank 1 pressure decayed to 
below the required inlet press tire of the fuel cell oxygen regulator. The 
oxygen regulated pressure then dropped to the nitrogen pressure level where 
the fuel cell could no longer sustain the load and was removed from the 
bus. The failure mode was identical to that experienced by fuel cells 1 
and 3. 

Three caution and warning alarms for fuel cell 2 hydrogen high flow 
rate occurred at about 56 hours and were caused by fuel cell 2 supporting 
the high power loads, which exceeded the 0.1617 pound per hour alarm trip 
level for hydrogen flow. 
















Fuel cell oxygen supply valve 



Figure 4-41.- Solenoid valves for oxygen supply. 
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4.11 FAILURE MECHANISM 


A large number of postulated mechanisms were examined, and the scope 
of the review is reflected in table 4— II, Many of the potential mechan- 
isms were quickly eliminated by comparing the end result , or the reaction 
rate produced by the mechanism, against the observed flight data. Others 
were eliminated on the basis of data from the literature or from tests 
that showed the mechanism to be a second or higher order effect. Of the 
mechanisms listed in the table as "possible ," the one that satisfies the 
flight data is initiation of combust! on in the tank by electrical shorts . 
The association of fan energization, the electrical shorts at the start 
of pressure rise, and the availability of sufficient electrical energy 
in the fan circuit to cause ignition of the polytetrafluoroethylene led 
to the fan motors and power leads being the most likely point of ignition. 

Electrical power for the fans, heaters, and quantity probe system is 
provided through a 24-pin electrical connector, which is the electrical 
and mechanical interface with the cryogenic oxygen volume. Seventeen 
wires and the shielded cable are soldered to the connector, and these 
wires extend through approximately 32 inches of conduit coiled in the 
upper cap of the vacuum jacket and enter the pressure vessel through the 
boss about 5 inches from the temperature sensor. The conduit is 
of Inconel X— 750 (AMS 5582). Each wire is insulated with color— coded 
polytetrafluoroethylene insulation about 10 mils thick. Table 4-III 
lists the materials in the connector and conduit. In addition, the wire 
bundles for various systems are enclosed in heat-shrinkable type poly- 
tetrafluoroethylene sleeving (0.012 inch thick). A total of about 0.1 
pound of polytetrafluoroethylene insulation is present in the electrical 
connector and conduit and when totally combusted would yield about 
195 Btu of energy. 

The fan wiring leads consist of two harnesses of four wires each for 
the two 3-phase fan motors. Wires (MIL-W- 16878 , type E) are 26-gage 
nickel and are coated with 0.010-inch polytetraiiuoroethylene insulation. 
Also, each harness of four wires is covered in some regions with a poly- 
tetrafluoroethylene sleeve of approximately 0.012-inch thickness. Wire 
runs of the two fan .harnesses are as indicated in figure 4-42 and are 
identical, except that the lower fan harness is routed through a tube in 
the heater assembly. 

The fan motor power leads internal to, and near, the heater assembly 
are extremely vulnerable to heat damage in abnormal operations. This has 
been demonstrated dramatically in a test employing approximately 8 hours 
of continuous heater operation. The insulation degradation caused in a 
test simulating the detanking cycle used on oxygen tank 2, (discussed in 
section 5-0) is seen in pictures of the wiring which failed (fig. 4-43). 
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TABLE 4-II.- INITIATION MECHANISMS 


Meehan lam 

Significant Data 

Asses sment & 

Fan Motor 

Assembly and Leads (Electrical) 


Ohmic heating of field coils 
(stalled rotor) 

Ignition unlikely based on low pressure 
1 g test data and low power input (30 
watts total per motor). 

Unlikely 

Continuous shorts (in leads 
or coil) 

Ignition possible based on hot wire 
ignition test data. Can get 1 to 2 amps 
through fuse. 

Possible 

Intermittent shorts (in leads 
or coil or to housing) 

Sufficient energy available from inverter 
to ignite insulation (North American 
Rockwell and Manned Spacecraft Center 
test). 

Possible 

Fabrication and assembly 
error 

Both motors passed preflight room tem- 
perature tests August 1966. Would require 
degradation and failure after extended 
period of normal usage. Data included 
elsewhere in the report. 

Unlikely 


Fen Motor Assembly and Leeds (Mechanical) 


Loss of fan parts at high RPM 
(impact or friction ignition) 

Loss of fan unlikely (s elf-lock ing nut 
and square shaft). Parts considered as 
contaminants . 

Unlikely 

Overheated bearing ignites 
Rulon A retainer 

Ignition temperature U63 0 C at 2000 psi 
gaseous oxygen. 

Unlikely 


Low energy source (motor torque 0.9 in-oz.) 
limits energy input into bearing. When 
bearing seizes, becomes stalled rotor 
(covered separately). 


Rotor or fan blade contacting 
adjacent structure (friction 
ignition) 

Ignition of aluminum possible. 

Pre flight checkout showed no problem. 
No cause for occurrence in flight. 

tfalikely 

Heater and Controls (Electrical) 

Element shorted to sheath 

Heater not powered at time of incident. 

Unlikely 


Heater operation normal in both tanks 
prior to tank incident (cryogenic data). 


Leads shorted to ground 
Intermittent shorts (sparking) 

Heaters not powered at time of origin 
of incident. (Verified by detailed 
review of current tank pressure data.) 

Unlikely 
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TABLE 1+-XI.- INITIATION MECHANISMS - Continued 


Mechanism 

Significant Data 

Assessment 0, 

| Heater and Controls (Electrical) - Continued 


Inadvertent operation of heater 

Flight data (current) voltage shows 
no indication of inadvertent operation. 

Unlikely 


Inadvertent operation would not account 
for energy release in tank unless com- 
bined with chemical reaction. 


Oxygen in thermal switch 

Previous operation normal and switch 

Uhlikely 

(ignited by spark or impact) 

in closed position at time of event. 


Heater and Controls (Mechanical) 


Impact 

Requires impact or energy source from 

Unlikely 

Friction 

some other event. 


Shock wave 



Material yielding 

No failure or loading mechanism in 

Unlikely 

Fracture 

this time period which can be explained 
by flight data. 


Quantity Gage Assembly (Electrical) 


Short between plates, and 

Off scale data could confirm short 

Unlikely 

between plates and ground 

between plates. 

Maximum power input less than 7*35 
mi Hi Joules 

Insufficient data on energy required 
to ignite insulation. 

No correlation with flight voltage 
transients. 


RF heating 

Insufficient energy input. Analyzed 
by North American Rockwell to be 
350 nanowatts maximum. 

Unlikely 

Quantity gage plate lead 

No power to heater (not on) confirmed 

UnHkely 

short to heater lead 

by main bus current data. 

Maximum power input less than 7*35 
mi lli Joules from probe. 

Insufficient data on energy required 
to ignite. 

Temperature transducer short 

Flight data indicate normal function 
after initial pressure rise in tank 2. 

Maximum energy input is less than 
microjoules. 

Unlikely 
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TABLE It- II.- INITIATION MECHANISMS - Continued 


Mechanism 

Significant Data 

Assessment 8, 

| Quantity Gage Assembly (Mechanical) 

Impact 

Requires prior event* net associated . 

Unlikely 

JViction 

with gage, for energy source. 


Shock wave 



Yielding 

No loading mechanism. 

Unlikely 

Fracture 

Consistent with data. 


Pressure Vessel (Electrical) | 

Ohmic heating to produce 

No sustained high currents, low power. 

Unlikely 

overpressure 

Heater and fan leads could touch vessel. 



Heater leads not powered. 


Spark discharge to pressure 
vessel — 

Same as above. 

Unlikely 

Pressure Vessel (Mechanical) 

Impact 

Impact source not identified. 

Unlikely 

FViction 

Friction source not identified. 

Unlikely 

Fracture 

Vessel intact after event initiation. 

Unlikely 

Yielding 

Below yield stress when event initiated. 

Unlikely 

Shock wave 

Shock source not identified. 

tM likely 

Vacuum Jacket 

and Associated Equipment (Electrical) 


Ohmic heating of vacuum Jacket 

No internal current sources except 

Unlikely 

or pressure vessel 

vac-ion pump. 



No continuous high currento , no indi- 
cation of external arcing possibility. 


Vac-ion pump failure resulting 

Requires oxygen leakage from tank to 

Unlikely 

in sparking and ignition of 

cause difficulty. Vac-ion pump turned 


material 

off prior to launch. 


Vacuum Jacket 

and Associated Equipment (Mechanical) 


Impact 

Oxygen required, not available unless 

Unlikely 

Friction 

leak or failure occurred. 


Fracture 



Yielding 



Flow from pressure vessel 

Long exposure of Mylar to liquid oxygen 

Possible 

leak causing ignition of 

increases its impact sensitivity and de- 


aluminized Itylar 

gree of reactivity. Impact threshold level 
decreases and the reactivity progresses 
from charring to the exposive state. 
Aluminized Itylar unacceptable in liquid 
oxygen impact. 



























Mechanism 


Significant Data 


Other Possible Causes 


Foreign material in tank 

a. Lubricant and glass beads 


b. Rivet or rivet pin 

c. Quantity gage button 
spacers 

Inadvertent substitu- 
tion of titanium for 
steel 

Broken safety wire 


d. 


e. 


Tank electrical connector 
failure . (Bad connection 
resulting in spark ignition.) 


Ionization due to cosmic radi- 
ation (resulting in spark dis- 
charge at quantity probe). 


Gaseous fuels (such as hydrogen) 
produced by metabolism of micro- 
organisms 


Triboelectric charging of tank 
interior causing spark ignition 


External plumbing problems 


Found on ground support equipment filter 
after first pad fill. 


Oversize rivet hole in quantity gage. 
Flow stoppage during detanking. 


Identical size and shape parts for oxygen 
tank and hydrogen tank. Same basic part 
number, dash number different. 


Twisted wire on Beech motors and filter. 


AC current anomalies could be related. 
Wire insulation is available fuel. 


Solar events which occurred during flight 
were after the event. Very high voltage 
required for dielectric breakdown of gas. 


Nutrients not available. Metabolic rate 
near zero at low temperature. Aerobic 
species are not known which produce oxi- 
dizable products. 


Tank and shell are at vehicle potential. 


Assessment 


Liquid oxygen flowing over pressure trans- 
ducer can cause apparent pressure increase. 
Temperature flight date and probe behavior 
cannot be explained, 'lay blow-out ques- 
tionable. 


Possible 


Possible 


Unlikely 


Unlikely 


Unlikely 

Unlikely 


L analysis nerfomed. 











TABLE 4-III.- MATERIALS IN CONNECTOR AND CONDUIT 


Service 

Number 
of wires 

Wire size 

(awg) 

Material 

Heater 

k 

20 

Silver plated copper, polytetra- 
fluoroethylene insulated 

Quantity probe 

1 

20 

Nickel - polytetrafluoroethylene 
insulated (outer probe) 


1 

20 

Nickel - polytetrafluoroethylene 
insulated (inner probe) 

Temperature 

sensor 

k 

22 

Nickel - polytetrafluoroethylene 
insulated 

Motors 

8 

26 

Nickel - polytetrafluoroethylene 
insulated 

Sleeve 



Heat shrinkable polytetrafluoro- 
ethylene tubing 

Connector 



Inconel with gold plated pins 

Solder 



60 percent tin, 40 percent lead 



















86 


This test shewed that insulation will, he severely damaged hy the abnormal 
heater operation so that numerous locations for electrical shorts or arcs 
are available when the fan circuits are powered. 

By this mechanism, an arc ignition could occur in these leads. The 
maximum electrical energy available in the fan motor wiring during the 
first short is about 160 Joules. Tests confirm that the ignition energies 
of this material by a spark source is less than 1 Joule. The rate of prop, 
agation has been shown by test to be greatly affected by flow and gravita- 
tional conditions in the tank (zero-g rate is less than one-g rate). As 
a result, it is difficult to assess actual propagation at the time of the 
failure. The 14-second plateau in’ the pressure-time flight data could be 
due to partial blocking or slowing of the flame front as the flame propa- 
gates to a grommet and must penetrate a thicker, better thermally-sinked 
component. Other barriers to propagation are also possible. 

The total energy available from complete combustion of the wire in- 
sulation was determined by estimating the weight of the wire insulation 
and sleeve material and using literature data on the heat of combustion 
of polytetrafluoroethylene (2100 to 2200 Btu/lb). These estimates are 
summarized in table U-IV. Combustion of wire insulation will furnish 
sufficient thermal energy for the process requiring minimum energy for 
the tank pressure increase as described in section 4.3. 

Tests have shown flame propagation into the conduit region will 
cause rapid degradation and failure of pressure integrity. It is also 
significant that this is the 'only region where the wire insulation comes 
in close proximity to the pressure shell. A test has shown that ignition 
of the wire insulation at the electrical connector end restated in very 
rapid failure of the conduit with little pressure or temperature response 
back in the simulated pressure vessel. A test with ignition outside the 
conduit and propagation along wire insulation into the conduit caused 
very rapid failure of the conduit. Additionally, a "torch" effect en- 
larged the opening as a result of melting or burning of the metal in the 
conduit tank interior region. This latter effect could explain the rapid 
loss of pressure from tank 2 as well as other higher order effects. 


TABLE 4-1 V.- HEAT AVAILABLE.. FROM WIRE INSULATION 


Heat available 

Locatii a from wire insulation 

(Btu) 

Zone 1* ** 195 

Zone 2»» 38.6 

Zone 3*** 34.4 


*Zone 1 - Wire insulation in conduit from connector to tank- 
conduit interface . 

**Zone 2 - Wire insulation from tank-conduit interface to lowest 
portion of upper polytetrafluoroethylene - 25 percent glass probe 
insulator. 

***Zone 3 - All other wire insulation. 


PRECEDING PAGE BLANK NOT FILMED 


89 


5.0 PREFLIGHT CONTRIBUTING EFFECTS 


A comprehensive review of the history of cryogenic oxygen tank 2 
was made to determine whether an unfavorable condition could have existed 
prior to launch. This review included test records, materials review 
dispositions, and failure reports. No positive indication of any un- 
favorable conditions prior to shipment could be found in the testing or 
inspections conducted. However, an abnormal condition was found in the 
prelaunch detanking procedure which is discussed in 5.1. 

In addition to the review discussed, a special review and demonstra- 
tion of the assembly methods used to install the wiring, fans, heater 
assembly, and quantity probe was made by the vendor for this investiga- 
tion. The installation procedures for the heater, fan, and probe wiring 
were found to be critical for several areas where routing damage would not 
be visible on the assembled product. However, this condition most likely 
did not contribute to the ultimate loss of the tank pressure in flight. 

A detailed assessment was also made of the incident where the oxygen 
shelf hoist assembly failed during the factory removal of the tank shelf 
from the Apollo 10 spacecraft (fig. 5-1). Analysis and test show that the 
maximum shock upward would be about 7 g' s , and the maximum shock downward 
would be about 15 g's. Analytically, the components within the tank would 
be expected to withstand 100 g*s shock. Consequently, this condition is 
not believed to have contributed to the ultimate failure of the tank in 
flight. 

The condition which most probably led to the failure, occurred dur- 
ing the special detanking procedures used after the countdown demonstra- 
tion test. 

The cryogenic oxygen tank 2 could not be off loaded after the initial 
filling during the countdown demonstration test using the normal procedures. 
The problem resulted from loose or misaligned plumbing components in the 
dog-leg portion of the tank fill path (fig. 5-2). Allowable manufacturing 
tolerances are such that the tank may no 1 ; be detanked normally tinder these 
conditions. A test has verified this fact. The condition of loose plumb- 
ing in the probe assembly, which existed in the tank before the detanking , 
was judged to be safe for flight in every aspect. 

After numerous attempts with gaseous oxygen purges and higher expul- 
sion pressures in en attempt to remove the fluid, the fluid was boiled 
off through the use of tank heaters and fans , assisted by pressure cycling. 
The sequence of detanking is shown in figures 5-3 and 5-4. The heater-on 
time was about 8 hours. It was thought that no damage would be sustained 
by the tank or its components because of the protection afforded by the 
internal thermal swit ches . 









Manufacturing tolerance study. 
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The thermal switches, which normally open at about 80° F, show no 
sign of operation from the heater voltage data. Inflight, these switches 
have not operated due to the temperatures in the tank. Further, the 
switches in the past have not operated under a load on the ground, and 
they were not designed or tested for this condition. 

In the case of Apollo 13, the use of the heaters to assist in detank 
ing required the switches to open under load. This is the first time the 
switches were operated with 65 V dc and 6 amperes which is twice the nor- 
mal flight operating conditions for each heater. Tests show that opening 
the switches under these ground power conditions will fuse the contacts 
closed at the instant of power interruption (fig. 5-5). Tests have veri- 
fied that when the heaters are on for the duration experieced during pre- 
launch operations (approximately 8 hours), the fan motor wire insulation 
is severely degraded (fig. U-l»3). 

Wiring can be damaged within a couple of hours , with the heaters 
being "on" continuously as evidenced by the temperature on the heater 
assembly (figs. 5-6 and 5-7). 
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Thermocouple 1 and 2 
•Thermocouple 5 and 6 



Thermocouple 23 
Gas temperature 


Thermocouple 7 

Thermocouple 8 

Thermocouple 25 

Inside lower fan wire conduit 

(latter test only) 

Thermocouple 9 

Thermocouple 21 on 400 Hz conduit 
Thermocouple 10 
-Thermocouple 11 


Thermocouple 12 

Thermocouple 13 
Thermocouple 24 

Thermocouple 14 


Thermocouple 17, 18 


Figure 5-6.- Heater/fan temperature sensor locations 
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6.0 CONCLUSIONS 


The analysis of the data and results of special tests associated 
with the incident leads to the following conclusions . 

1. The detanking problem which occurred during the countdown demon- 
stration test resulted from loose or misaligned fill-line plumbing compo- 
nents within the tank. This condition was not the direct cause of the 
anomaly, but did result in the use of a special detanking procedure fol- 
lowing the countdown demonstration test. 

2. Both heater thermal switches failed closed from heater operation 
during the special detanking. The failed switches allowed continuous 
heater power to be applied, and led to severe damage of the insulation 

on the power wires leading to a fan motor. 

3. The failure of the thermal switches was caused by an incompati- 
bility between the capacity of the switches and the voltage vised from the 
ground power supply. 

4. A fire was started by electrical short-circuits in. the wiring to 
the fan motors inside oxygen tank 2 shortly after the fan circuits were 
energized for the seventh time. 

5. Burning of the insulation proceeded for about 80 seconds before 
reaching the pressure vessel electrical conduit; through which all elec- 
trical tank wiring passes. The heat of the burning caused failure of the 
Inconel conduit first, and ultimately led to the failure of the vacuum 
dome and separation of the bay 4 structural panel. 

6. The internal component design of the tank lends itself to pos- 
sible damage which can go undetected. Further, the plumbing parts have 
tolerance allowables which can build up to prevent normal detanking. 

7. The design of the warning system for indicating the position of 
the reactant valves to the fuel cells does not allow detection of indi- 
vidual valve closures to any fuel cell, a condition which existed during 
this incident. 


